Entra ID interview questions with scenario answers
Short, honest answers beat memorised definitions. Each answer below shows the reasoning interviewers listen for.
Fundamentals
Section titled “Fundamentals”1. What’s the difference between a user’s home tenant and a resource tenant?
Section titled “1. What’s the difference between a user’s home tenant and a resource tenant?”The home tenant is where the account lives and is managed. A resource tenant is another organisation’s tenant the user is invited into as a B2B guest. Policies from the resource tenant (for example, Conditional Access) apply when the guest accesses its resources.
2. Password hash sync, pass-through authentication or federation — which would you choose?
Section titled “2. Password hash sync, pass-through authentication or federation — which would you choose?”Default to password hash sync: simplest, cloud-resilient, and it enables leaked-credential detection. Choose pass-through authentication when policy requires passwords to be validated on-premises. Choose federation only for requirements the cloud can’t meet — it adds infrastructure to run and secure.
3. Eligible vs active assignments in PIM?
Section titled “3. Eligible vs active assignments in PIM?”Active means the role is always on. Eligible means the user activates it when needed — with MFA, justification or approval — for a limited time. Eligible assignments reduce standing privilege, which is the point.
Conditional Access
Section titled “Conditional Access”4. A new MFA policy is about to go live. How do you roll it out?
Section titled “4. A new MFA policy is about to go live. How do you roll it out?”Exclude break-glass accounts, start in Report-only, review impact in the sign-in logs, use What If for edge cases, pilot with a group, communicate, then switch on in waves.
5. A policy requires MFA, but some sign-ins succeed without it. Why?
Section titled “5. A policy requires MFA, but some sign-ins succeed without it. Why?”Check the sign-in log’s Conditional Access tab. Usual causes: the user or app is excluded, the app isn’t in scope, the client used a flow the policy doesn’t target, or a trusted location exclusion applied.
6. How do you block legacy authentication?
Section titled “6. How do you block legacy authentication?”A Conditional Access policy for All users, All resources, client apps Exchange ActiveSync and Other clients, grant Block. Check sign-in logs first to find what will break.
Scenarios
Section titled “Scenarios”7. An admin locked everyone out with a Conditional Access policy. What now?
Section titled “7. An admin locked everyone out with a Conditional Access policy. What now?”Sign in with a break-glass account, set the policy to Report-only or Off, find the root cause, and add the missing exclusion or fix the condition. Then review why break-glass accounts weren’t the only safety net — change control, Report-only, What If.
8. A script fails with AADSTS50076. What do you change?
Section titled “8. A script fails with AADSTS50076. What do you change?”The script is signing in with a user’s password and can’t complete MFA. Move it to app-only authentication with a certificate or a managed identity. Don’t exclude the account from MFA. See AADSTS50076.
9. How would you find and remove stale guest accounts?
Section titled “9. How would you find and remove stale guest accounts?”Report guests by last sign-in with Microsoft Graph (signInActivity), agree a threshold with resource owners, then use Access reviews to remove them in a controlled, auditable way.
10. What are break-glass accounts and how do you protect them?
Section titled “10. What are break-glass accounts and how do you protect them?”Two cloud-only accounts with permanent Global Administrator, phishing-resistant authentication, excluded from Conditional Access, alerting on every sign-in, and tested every 90 days. See the SOP.
Weekly · 5-minute read
The Identity Brief
Identity & Microsoft 365 changes that need action, one SOP, one script — every week. Verified against official Microsoft sources.
No spam. Unsubscribe anytime. Privacy